From 58bd4df3b19ac20dea0e41cfc939a0c62bbb6db9 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 20 May 2026 17:34:30 +0200 Subject: [PATCH] client-enrol: republic-laptop pubkey + hello.yaml recipient Phase 2 first workstation enrolled. age1vf8... is republic-laptop's issued pubkey; added as a recipient on hello.yaml so the post-bootstrap decrypt test works there. Co-Authored-By: Claude Opus 4.7 (1M context) --- .sops.yaml | 3 ++- hosts/republic-laptop.yaml | 1 + inventory.yaml | 2 +- secrets/hello.yaml | 29 +++++++++++++++++++---------- 4 files changed, 23 insertions(+), 12 deletions(-) diff --git a/.sops.yaml b/.sops.yaml index 7ee95ff..dee6b76 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -22,7 +22,8 @@ creation_rules: # they enrol; re-key with `sops updatekeys -y secrets/hello.yaml`. age: >- age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6, - age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0 + age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0, + age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6 - path_regex: ^secrets/gitea-tokens\.yaml$ # Workstations only. diff --git a/hosts/republic-laptop.yaml b/hosts/republic-laptop.yaml index ad4be76..deffb6f 100644 --- a/hosts/republic-laptop.yaml +++ b/hosts/republic-laptop.yaml @@ -13,5 +13,6 @@ mesh_globals: accepted: - netbird - tailscale +age_pubkey: age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6 mcp_endpoint: https://mcp.hubris.network/sse secrets_issuance_endpoint: https://secrets.hubris.network/issue diff --git a/inventory.yaml b/inventory.yaml index 4628bca..5ee7f63 100644 --- a/inventory.yaml +++ b/inventory.yaml @@ -351,7 +351,7 @@ hosts: os: linux role: primary-dev mesh: {netbird: {fqdn: republic-laptop.netbird.selfhosted}} - age_pubkey: "" + age_pubkey: age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6 mac-mini: kind: workstation diff --git a/secrets/hello.yaml b/secrets/hello.yaml index 1877a7b..6842673 100644 --- a/secrets/hello.yaml +++ b/secrets/hello.yaml @@ -9,20 +9,29 @@ sops: - recipient: age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6 enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKQjZrSWpEbCsvNlB0NTdh - MU9hN3pSU1lkVXM0OUFqNUsrWUVlR3ExU2lVCjF2U3BCc0xlMHRPcEY2ZkdKZW41 - TTlRNVBRbzlHVTh2T0krRTAzaFFMUnMKLS0tIG8vTTAyNlc5RXNOdkR4cWVKTGtk - NE9xeXRKR0c5Q1k3OVhzQmtYeHpjamsKdSfpAKgJaas7AhlUTplzcnMsAI/1NBJ4 - uWD0IlJsIR3B2l/3h5LgrhkyQj/hLI5pFMptNwLXQUjN+Kleq5v/QQ== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoQXlnbG4zZlNTbDduSENL + b295UkVWcUpXMkxPSS9WTW9TRCs0aWx0WXg0ClpJVE9KU1ZRYVdtTFFtMktkdnBB + NFFTYjIxL0F2M3M4a2VBRXVYYWJKbE0KLS0tIFpPTFY5QjVDWUw2ODcyQWx0NmpP + eGJRbHBqWTgvVnZCN0Mrc29pblpieUkKDWqdmZMPvFC2Eaql9KHG19Pi0ek4/cKE + bewjSZ/7GZ/ov3xBFWjBVfBepeWnwwrd1NgBKPckm6wMxDPZU5gTag== -----END AGE ENCRYPTED FILE----- - recipient: age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0 enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxaWFOOWI3cFMrWGt1RGow - RE5icW1rVEIraGExWWlqSmQ2aGh6aVNoS2hjCjZyRzBCZGpyczRySmErYkNPWHBM - N0RweWVmeUlQK1lNTnFQN1VqMVZlalUKLS0tIGpnNzRlaUJSVkE0RDVSRXBqV2t0 - b09sVU9neWRPYkdVSmhRd3pZelkzTmsKEEvuq8cVtX/zVji3V+SqX/4cZitBD20U - w5NUMIT8gXHBVE5uTXqRmFPXGD9PgnCy0CZbE9CguZwav8a4KGYOPw== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnWENBRzR5UTNkdStOOVps + QjVreEZqZWZmcmxMZEFJbEtUOGNkYlZXOGlZCm81OE9RK1ljTVJ0K0tHM2xzaEFq + Um1zR1loTmVDVUxyU0VPSXo1YzNkczQKLS0tIHBnR1N1dlhTQ0pnNTU1a3FIaE9l + dHJxTXRXWWo2Njd6eVJYeUc4RXR0YVkKGtia6ZGBXmNTzBTNA4fVvIT0h+2egC6I + mzilX73imv5ytxbS88jvT8t/qeb8m5he4dybWx1FKaikKlkqRWCygg== + -----END AGE ENCRYPTED FILE----- + - recipient: age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmVmkydnptdWQyczVWeVNw + YkZsZUR0VzJjeGRnNG9VV1NWUWpPb0lRaDNBCnhxTExybG5OcVdic0lWUjM3dGNL + R2NqL2FxVjFOR1d4VnlFK0pMeFg2Y00KLS0tIFpEV1BWR05qd0dWbEJVSFo4cjRN + R0prZ0NyWjlJUzFYV2JwSnZmY2tBeGMKki3BOJlofZV759eKgqO3JJfJbZyygMqV + DmPcrwQUEXZcB5p9CRb2Y87utL0DdYJBvreiPGRLcEZxrK60RyhPEA== -----END AGE ENCRYPTED FILE----- lastmodified: "2026-05-20T14:39:14Z" mac: ENC[AES256_GCM,data:CAoIW1sJkIbNoXMaVlXwfHdREzATNqDKpSN5ecaSiRARThB0/tcLNbkazXKyV1Rx5b+b3s+yCpBzwmNnH6ytaCzG5pKPcnfd6YJq7C5rm/EQHyaVGrPdBsSfqiz4yBXKClej//v3+qkD5Ls2PMppv5KmqigOKNQC/ot3ht2c7lM=,iv:eOmDDclksr9f9CDu6dJprSFwlWuoggzVFjyfqWf5Uhg=,tag:IU3sMlIi92ohM86zOIJdAg==,type:str]